CN1160616C

CN1160616C - Anti-virus agent for use with database and mail servers

Info

Publication number: CN1160616C
Application number: CNB971994595A
Authority: CN
Inventors: Ch; C·H·陈; C·K·罗
Original assignee: Cheyenne Software Inc
Current assignee: Cheyenne Software Inc
Priority date: 1996-09-05
Filing date: 1997-09-05
Publication date: 2004-08-04
Anticipated expiration: 2017-09-05
Also published as: CA2264816A1; DE69722266D1; ATE241169T1; ZA977970B; WO1998010342A3; EP1237065A2; US5832208A; DE69722266T2; EP1010059A4; CA2264816C; EP1010059A2; KR20010029480A; AU4253597A; AU735236B2; ES2199372T3; RU2221269C2; KR100554903B1; JP2001500295A; HK1047327A1; HK1023826A1

Abstract

A software agent (110) for detecting and removing computer viruses located i n attachments to e-mail messages. A client-server computer network includes a server computer and a plurality of client computers. A message system (130), located at the server computer, controls the distribution of e-mail messages. An anti-virus module (120), located at the server computer, scans files for viruses. The agent (110) is located at the server computer and provides an interface between the anti-virus module (120) and the message system (130). The agent can operate both on a real-tim e basis and at preset period intervals. E-mail messages that are sent internally within the network can be scanned, e.g., Intranet e-mail messages. In addition, e-mail messages received over the Internet can be scanned.

Description

Be used for detecting and remove the method and system of the computer virus of Email attachment

Invention field

The present invention relates to one and be used to detect the also software program and the interface of dump virus, relate in particular to the system and method for the computer virus in detection and clear data library file and the e-mail attachment.

Copyright notice

The partial content of this patent file comprises the material that belongs to copyright protection.When it appeared in the patent literature or record of patent and trademark office (Patent and Trademark Office), the literary property owner did not oppose that anyone duplicates this patent documentation or patent content.Otherwise keep all literary property rights.

Background of invention

Computer virus is a computer program, changes the method for operation of computing machine under unwarranted situation.Similar to biological virus, computer virus can duplicate and self be attached on other file.

For becoming computer virus, a program only need satisfy two standards.At first, it is executable, and often certain version with its code is placed in another program implementation path.Computer virus often carries out it self.The second, it duplicates self.For instance, a Virus can copy self other executable file or disk to user capture.Many computer viruses will self be attached on other executable file.

Virus is replicated at an infected file, downloads, or is propagated when using.Virus can be invaded the workstation (comprising desk-top computer and laptop computer) and the webserver etc.

Many viruses are destroyed the infected computing machine or the webserver when carrying out.Some viruses are designed to by making program paralysis, deleted file, or method such as reformatting hard disk is destroyed computing machine.When virus damages, destructiveness depends on the specific virus of infect computers and changes.Usually, virus can cause following destruction to computing machine: hang up computing machine, deleted file confuses the data on the hard disk, attacks file allocation table, attacks partition table, or disk format.

Other viruses are a little tedious things, constantly duplicate oneself, or output text, video or audio message.Even these benign virus, still can throw into question, because they occupy the calculator memory that legal procedure uses usually to the computer user.As a result of, they often cause unsettled behavior, and make system crash.In addition, many viruses are full of mistake, and those mistakes can cause system crash and loss of data.

Personal computer virus can be classified according to the mode of its propagation and infect computers.The system region of boot section type virus infections disk, that is, and the leader record on floppy disk and the hard disk.The small routine of carrying out when all floppy disks and hard disk (comprising the disk that only contains data) all comprise a computer starting in leader record.Boot section type virus oneself is attached to this part of disk with them, and attempts to activate when infected disk starts the user.Thereby type virus in boot section covers the original boot section of this disk with its code, makes virus what its content always in office be loaded into internal memory before.In case in internal memory, virus can make boot disk use, or propagates into other disk.Master boot sector type virus covers the master boot sector (partition table) of disk, first sector that this master boot sector is a hard disk.File Infector Virus infects other program when an infected program run.For being activated, File Infector Virus must be carried out.They are not retained in the internal memory, so they do not infect system.File Infector Virus self is attached to executable file (such as containing as .COM .EXE .OVL .DLL .DRV .SYS, the executable file of the extension name of .BIN and .BAT) with them.These viruses often change file attributes information and file size, time and date information.RAM resident type virus is with they self graftabl and take over the control of operating system.As File Infector Virus, RAM resident type virus self is attached to them on the executable file.Mixed type virus combines RAM resident type virus, the feature of File Infector Virus and boot section type virus.

A kind of Virus Type recently, macrovirus.Be to use specific computer program, write as the macrolanguage of word processor or tabulation software.Therefore macrovirus can reside in the document.The macrovirus infected file, and can be when carrying out terminate-and-stay-resident.They can be at documentation of program accessed or operation when being triggered by certain user action, this user action such as specific keystroke or menu are selected.Macrovirus can be stored in the file that contains any extension name, transmits by file, even is propagated by Email.Although usually not by the virus infections of type previously discussed, the grand application software of any support that automatically performs all is the potential platform of macrovirus in the document in the past.Because now document is shared widely by network and the Internet, even surpassed sharing of disk in the past, may become more popular based on the virus of document.

Even the manufacturing behavior of doing it on purpose of virus, virus are usually at user's copy of an innocent person or download the network that infected file is introduced into computing machine and enterprise on computing machine or network the time.

Traditional antivirus software is designed to detect and dump virus.Virus is detected with two kinds of basic modes by antivirus software: by scanning fully or the real time scan when each file is accessed to hard disk.Most antivirus softwares provide this two specific character simultaneously.And virussafe can be by the file or the file directory of the one or more users' selections of instruction scan.

Scanning and real time scan detect known viruse with feature code (as viral fingerprint) fully, and program of this feature code identification is a virus.Some antivirus softwares also using advance technology (such as polymorphic detection) are discerned potential virus, and the virus in procuratorial work internal memory and the system file.

Existing anti-virus product is worked finely when floppy disk is main equipment to calculator memory input data.But in recent years, electron transport has become the common approaches with the electronic form swap data.Not surprisingly, electron transport has not become main virus threat yet.Existing antivirus technology does not guarantee to prevent that virus is introduced into computer network and propagation therein in various possible modes.

Many enterprises have computer network sharing and be used to exchange messages with permission program and data.Along with network, the growth of communication in enterprise calculation and the tissue, (for example, using client-server network and equality network, LAN (Local Area Network) and wide area network), virus can easily be propagated by the computer system of tissue, infects many computing machines.And exchanges data just is being to use the reason of these schemes, and the virus in the enterprise on computing machine is than more may and infecting them with other computing machine communication several years ago.And many organization internal networks have the electronics connection (such as the Internet, special-purpose online service, and bulletin board) to external computer networks.These connections make electronic data and computer program (comprise those may by computer virus infection) be introduced into the network of tissue.(according to NCSA (NCSA), the enterprise network above 70% is by virus infections.)

About computer virus, special concern be Email (e-mail).The continuous growth with communication in tissue (for example, using LAN (Local Area Network)) reaches and PERCOM peripheral communication (for example, communicating by letter with computer user at a distance by the Internet) in the use of Email.Email message can comprise additional file, for instance, comprises executable file, formatted document, and sound, video, etc.The annex that should be appreciated that email message can comprise by the file of computer virus infection.Like this, for instance, the Email that receives by the Internet can comprise a Microsoft Word document that is infected by the Word macrovirus as annex; Also may comprise to the email message of its many group member's broadcasting on LAN (Local Area Network) by the project manager by the annex of virus infections.

Because the file of any kind can append on the email message, virus protection software often is difficult to decision and how handles annex.In addition, the typical electronic mailing system is stored all email messages with distinctive file layout on mail server, and no matter the form of appended file.All message that received by a user can be stored as a single file, for example " inbox.msg " on central mail server.And some e-mail programs use distinctive encryption method.It is said scanning from the unusual difficulty of the e-mail attachment of LAN inside, because resemble cc:mail, the such e-mail program of Microsoft Exchange and Davinci is for the reason encrypted E-mail of privacy.Therefore, the form that e-mail program uses, the antivirus software that algorithm and data structure make exploitation prevent that virus from propagating by e-mail attachment become difficult.

An important goal of virussafe is to damage or virus detects virus before propagate being infected other computing machine as quickly as possible.Many virus checkers for instance, do not scan the virus of the email message that sends outward, allow the possible propagation of virus to other computing machine thus.Normally used virussafe do not scan the Email rough draft that is created but do not have to send (that is, and an email message, be created and store be used for editing after a while and/or sending).The virus detection software that relates to Email can only scan some e-mail attachment when some definite event takes place.Therefore, need all not detect virus in e-mail system in each moment that virus may enter or propagate.

Some products claim that can scan the file that is attached in the Email detects virus.For example, " the ScanMail for cc:Mail " of Trend Micro Incorporated issue can scan the e-mail attachment that receives by the Internet.This program is the software of an Agent Type, replaces original post office with its oneself the post office (virus detects and carries out therein) of acting on behalf of, and after detecting virus the Email of cleaning is sent to original post office.Like this, being received from the outer Email of network at first is scanned before entering the post office of system.(it is said that ScanMail protects internal lan by the virus in intercepting before virus arrives workstation and the isolation cc:Mail post office.) still, this framework can not scan the email message of Intranet.The inner message that sends and receive never arrives acts on behalf of the post office, and therefore can not be scanned.Thereby the user can send virus by Email at organization internal.ScanMail can not detect the virus in the e-mail attachment that produces and exist in LAN (Local Area Network).

That another claims energy scans e-mail annex is the InterScan VirusWall of Trend Micro Devices company issue.When it is installed on the UNIX internet gateway, InterScan VirusWall attempts intercepting and scans e-mail annex, and FTP transmit data, and WWW is downloaded, and uploads, and reaches the data of transmitting between household PC or the LAN (Local Area Network) and the external world.InterScan VirusWall is used for the FTP acting server of gateway communication by one and Simple Mail Transfer protocol (SMTP) acting server that one is used for Email is formed.The same with the ScanMail application software, InterScan VirusWall program can only be by the e-mail attachment of internet gateway; It can not scan at the inner e-mail attachment that transmits of LAN (Local Area Network).In addition, the InterScan application program operates on the gateway and scans independent bag, and when file on the network during greater than a bag big or small, it may be effective inadequately to the file that detects polymorphic virus or compression.

The product of the Antigen by name of Sybari issue passes to third party's virus scan instrument to detect virus with e-mail attachment.Yet if virus is detected and is eliminated, Antigen can not get back on the email message e-mail attachment is attached again.Although Antigen software can offer third party software with e-mail attachment, intrasystem annex will keep infected state, because do not have integrated to activate the virus of third party software healing in e-mail attachment between Antigen software and third party software.

Some virus checkers that are used for Email move in client, and scan the email message that sends to this user when the user opens his or her mailbox.Such system effectiveness is lower.Virus checker must be loaded into each client computer; Therefore, if 250 workstations are arranged, virus checker must be loaded 250 times.If omitted a workstation, perhaps virus just detect not come out.In addition, when the user opened his or her mailbox, scanning was carried out on the basis that postpones.If the user is not frequent Email User, when opening mailbox, perhaps there are many message to be scanned.Infected email message possibility is long-time not to be resided in the mailbox of not opening with detecting, and possibility is because automatic rule is automatically passed on by an Email that meets some feature of receiving and quilt is propagated to other users.

Thereby, needing a computer program, this program can scan and remove the computer virus in e-mail attachment, and does not damage the annex of email message.This program can be at all email messages, the Email that comprises those internal system (for example, Email between the user on the same mail server), those send to or are received from the Email of external electrical mailing system, or those have drafted and be stored in e-mail server but the Email that is not sent out.

Also need a centralized system, be used for scans e-mail message detection virus, and do not need antivirus software is loaded on all working station of network.

Summary of the invention

In exemplary embodiments, the present invention is a software program that uses with antivirus software (being called the agency here), is used for detecting and removing the computer virus that may be present in the e-mail attachment.

Agent computer program of the present invention is isolated e-mail attachment from email message, it is scanned with detection computations machine virus, (and, if desired, any detected computer virus is eliminated), then with the sub-email message of the attached again telegram in reply of annex.For all email messages, the present invention correctly works, this message comprises the email message (being called the Intranet Email herein) of (a) internal system, (b) send to or be received from the email message (being called internet E-mail herein) of an external electrical mailing system, (c) drafted also/or be stored in e-mail system but the email message that do not send as yet.

Should be appreciated that to be different from fire wall or to act on behalf of the post office that agency of the present invention makes the e-mail attachment of scanning enterprises Internet become possibility from the mailing system internal operation.

Therefore, the present invention will guarantee that all email messages will be scanned with protection internal electron mailing system.

And, in case virus detected and from annex, remove after, this annex is still a useful part of email message, and can be by e-mail system processing as usual.

An advantage of the present invention is that it operates in server end, rather than in client.Thus, the agency only needs to be loaded once on each mail server, rather than is loaded on every the workstation or PC of network.In addition, email message can be scanned and kill virus and no matter whether user's Email uses.Therefore, receive many Email cracks if the user is on furlough, they will be scanned and kill virus, thereby when the user returns, his or her mailbox will only comprise the email message that does not have virus.

A kind of like this efficient of method can be seen by the mail carrying of analogizing real world.If wishing to scan all mails, we detect bomb, in mail switching centre a scanning machine is set, when being classified, mail scans them continuously, and than among other a scanning machine being set, more efficient by run-down every day after sending at mail at each.

In exemplary embodiments of the present invention, the agency browses that each generates in customer network or is received from annex in the Email of external network, from database or mailbox, isolate each such annex, and send these annexes to integrated or independently antiviral application software.The agency can be attached to annex on the email message after being handled by antiviral application software again.

In addition, agency of the present invention can operate in server level, the viral detecting operation of concentrating thus.A user's Email can be scanned to detect virus does not need this user's login on network.In addition, the scanning of Email can be carried out on the regular basis clocklike, rather than only sending, carry out when reception or reading Email.

The invention provides an Application Program Interface, can be from the centralized management of webserver, thereby do not need to be installed in every workstation that the server of managing concentratedly is connected on.

The agency of exemplary embodiments of the present invention is designed to many Emails and Database Systems general and compatible.

Except that based on scanning termly, the present invention includes the real time scan ability, the scans e-mail annex is to detect virus when receiving new email message.

These and other advantage and characteristic of the present invention will become very obvious after for the detailed Description Of The Invention of those skilled in the art below having read and the accompanying drawing followed of research.

The accompanying drawing summary

Fig. 1 is the piece figure of a network architecture, and the present invention is implemented on this framework.

Fig. 2 is the module communication synoptic diagram between the present invention and the e-mail system.

Fig. 3 is a process flow diagram of describing operation of the present invention in detail.

Detailed Description Of The Invention

Referring now to accompanying drawing,, at first see Fig. 1, the there illustrates a computer network, and this network is a Local Area Network 100, is arranged to an operation Agent 110 of the present invention.

As here describing, the present invention operates on the LAN (Local Area Network) with user terminal/server framework.But, the invention is not restricted to such network or framework, for instance, it can easily be transformed to operate in such as on peer-to-peer network or the wide area network.And Agent can be integrated into other program, or is created as the part of other program, these programs such as network operating system, e-mail program, and/or virus checker.

Network 100 comprises a server 20, a plurality of personal computers (PC) 10 and workstation 30, and an internet gateway 40, and all these are joined together by communication line 15.As mentioned above, this network configuration only is example that can move agency's of the present invention network architecture type of diagram.Server 20 and personal computer 10 can be programmed to move a specific Email or database program, as Lotus Notes program or MicrosoftExchange program.Each personal computer generally includes an input equipment 16 (keyboard for example, mouse, etc.), an output device 12 (for example, monitor), processor 13 and internal memory 14; Similarly, workstation 30 also can comprise an output device 32, input equipment 36, processor 35 and internal memory 34.

In addition, gateway 40 is provided to external computer networks for network 100, and for example the Internet 42, visit.Agency 110 of the present invention is configured to and offers the Email and the Database applications software compatibility of server 20.

For describe clear for the purpose of, as used herein in the example, the agency 110 of exemplary embodiments of the present invention attempts scanning and is generated by Lotus Notes program, the file that sends or receive and the annex of message.For simplicity, term " email message " will be used to be described in the mail server and use, by all types of files that mail server sends or receives, message, broadcasting and communicate by letter the database program of this mail server such as Lotus Notes program or supporting attachment.Agency 110 of the present invention can also support the network mail and the database program of email message attachments with other, and as the Exchange program of Microsoft, cc:mail and the BeyondMail of Lotus move together.In addition, agency 110 can with public folders and forum (for example, a zone, the message that the user puts up in the above can be browsed by every other user) operation together.

Fig. 2 for example understands the software component of the exemplary embodiments of the present invention that serviced device 20 is carried out.The illustrational representational application software of being carried out by server 20 that is used for is the LotusNotes program.Lotus Notes server program 130 is configured in server 29 that other node in LAN100 sends and other node in LAN100 receives file and Email, and those nodes comprise internet gateway 40.One or more databases 140 (is Lotus Notes database 140 at this) storage is received, sends the email message of drafting or preserving.(in Lotus Notes, each database is used as a file and treats).The annex of email message by with this message stores in Lotus Notes database 140.Mail server 130 and database 140 can be considered to a message system together.The node of network (for example 10,30) can comprise the client mailer, and is mutual with mail server 130, allows the user to create, and reads, and sends, preserve, and editing e-mail message.

Antiviral application software 120 scanning documents to be detecting virus, and can remove virus from any infected file.In exemplary embodiments, antiviral application software 120 is InocuLAN programs, is provided by the Cheyenne software company of New York Roslyn Heights.The InocuLAN program can be considered to comprise two submodules, i.e. partial sweep module and task service module.The InocuLAN program is used as agency 110 user interface, for example, is set the time when scanning is about to take place, and reporting scanning result.

Agency 110 isolates the annex of email message and passes to antivirus software application software 120.

Fig. 3 shows and the agency's 110 of the present invention corresponding process flow diagram of operation that this agency cooperates with antiviral application software 120.Although agency 110 of the present invention is general for database and e-mail system, for the sake of simplicity, the scanning to email message will only be discussed below.In addition, suppose all email messages (that is all attachment files of all databases and mailbox) are scanned fully.In step 200, agency 110 determines whether there is annex in an email message.If there is no annex, agency 110 determines in step 240 whether whole mailing system 140 is scanned.If whole mailing system 140 has been scanned, act on behalf of 110 out of service.But if whole mailing system 140 is not scanned, agency 110 continues to handle next email message (step 235).If have annex in an email message, agency 110 isolates annex (step 205), and annex is sent to antiviral application software 120 (step 210).If antiviral application software 120 does not detect virus in annex, agency 110 is attached to original email message (step 220) again with annex.

But if antiviral application software 120 detects the existence of virus in annex, an alarm is generated (step 245).This alarm can be constructed in many ways.For example, alarm can comprise the text message of a system scope, is sent to every PC10 or workstation 30 among the LAN100, or the network manager; Perhaps alarm can comprise the message that is delivered to the generation or accepts the network node of this infected annex.After such alarm generated, antiviral application software 120 can (if having disposed like this) be deleted infected annex (step 250).So, annex deleted (step 255).After step 255, agency 110 determines whether whole mailing system 140 has been scanned (step 260), if scan, process arrives and finishes (step 230).If whole mailing system 140 is not scanned, agency 110 handles next email message (step 235).

If infected annex is not deleted in step 250, antiviral application software 120 is cured infected annex (step 270) under possible situation.If cured, annex is enclosed (step 220) again, if also have email message, agency 110 handles next email message.Agency 110 can handle the email message (comprising the Intranet email message) of LAN100 inside or enter the email message (the Internet e-mail message) of LAN100 by gateway 40 from the Internet.

InocuLAN program 120 will be reported to the police with the warning user to the individual of appointment by the Alert Generic Notification system of e-mail system or Cheyenne software company, so prevents the propagation of virus.The partial sweep instrument of InocuLAN and task service are cooperated with agency 110 and are detected and remove with the scanning of implementing virus in message system, and guarantee a virus-free environment.

Be to be used to realize that the false code in agency's 110 of the present invention APIs storehouse describes below.Agency 110 can be considered to high-level, the general storehouse of APIs.The agency 110 of exemplary embodiments can be used in combination with Lotus Notes and Micrisoft Exchange program.The agency 10 utilizes Lotus Notes API collection, and Micrisoft Exchange API collection and MAPI assist its function, for example, browses, and separates and adheres to e-mail attachment again.Those Lotus and Micrisoft APIs publish, and skilled programmer will understand them and can how be configured to and act on behalf of 110 mutual.Agency 110 is such one group of APIs that can be used to communicate by letter with mail server program 130 by antiviral application software 120.

In the false code below, " MDA " is a term, looks like to be the mail database agency.

" UID " is unique or general identifier, is used to discern an email message.This example hypothesis LAN uses Windows NT network operating system.

MDAConnectAgent (): the connection that is established to Message Agent.

At any needs＜agent_id〉be called before the MDA API Calls as input parameter.

Input:

Windows nt server name.

The name of Message Agent.

Windows NT user login name.

The characteristic data file name that is used to login (only being used for swap server).

The password that uses during with above-mentioned user ID and the login of user characteristic data file.

Output:

＜agent_id 〉, it is the connection identifier that is returned, and can be used for following the tracks of current connection example by the API Calls of back.

MDADisconnectAgent (): disconnection is connected with the current of Message Agent, is being called to discharge resource behind each MDA conversation end.

Input:

<agent_id>

MDAGetAgentInfo (): obtain the message system vendor information from the Agency.Can between MDAConnectAgent () and MDADisconnectAgent (), whenever be called.

Input:

<agent_id>

Quilt＜vendor〉size of the buffer zone that points to

Output:

＜vendor 〉, it be about with the information of the message system of agency dialogue.

MDAOpenDatabase (): open Lotus Notes database or ExchangeInformation Store.Call to obtain an active data storehouse handle for the first time.All need the MDA API Calls of database handle can be called then.MDAScanAllFindFirst () or MDAScanDatabaseFindFirst () will impliedly open information store.

Input:

<agent_id>

＜dbname 〉, the input Lotus Notes database name with being opened is set to sky for Microsoft Exchange.

＜istoreUID 〉, the user identifier with the Exchange InformationStore that is opened is set to sky for Lotus Notes.

Output:

MDACloseDatabase (): close a Lotus Notes database of opening or Exchange Information Store.The resource that is called and distributes to discharge.

Input

<agent_id>

MDAEnumObjects (): in a container, enumerate subobject.For Exchange and Lotus Notes, three layers of object are arranged, that is, and Agent, Mailbox/Public Istore, and Message.When＜input_object_type〉when being MDA_OBJECT_AGENT, return the tabulation of a Mailbox and Public Istore.When＜input_object_type〉be MDA_OBJECT_MAILBOX or Istore, return a messaging list wherein.Can between MDAConnectAgent () and MDADisconnectAgent (), whenever be called.

Input:

<agent_id>

＜input_object_type〉---the type of the input object enumerated, possible values is MDA_OBJECT_AGENT, MDA_OBJECT_MAILBOX and MDA_OBJECT_INFORMATIONSTORE.

The display name of input object.

The user ID of input object only is used for Exchange.

The size of buffer zone.

Output:

Be returned the type of object.

Comprise the buffer zone of the display name tabulation of subobject, finish by two null character (NUL).

The number of the byte of in above-mentioned buffer zone, returning.

The buffer zone that comprises the user ID tabulation of subobject.

The number of the byte of in above-mentioned buffer zone, returning.

MDAGetAllMsgUids (): the message user's identification list that obtains all message in openedMailBox or InformationStore.

Input:

<agent_id>

The size of user ID buffer zone.

Output:

Be included in the buffer zone of message user's identification list of the message among Mailbox or the Information Store.

The number of the byte of in above-mentioned buffer zone, returning.

MDAGetObjectProperty (): the interested characteristic of obtaining appointed object.

MDAScanAllFindFirst (): scan whole message system and return in the system of being stored at＜start_time〉tabulation of all attachment files of receiving after the time mark of appointment.If＜start_time〉be 0, all annexes will be scanned.To at first scan PublicInformation Store, scan Private Information Stores then.This API will cause first Information Store to be opened, and return a database handle in AFILE.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent (), but can not in officely what be called in its activity scanning sequence.This API can not be called when the activity database handle exists.Must call MDACloseFindHandle () and finish a scan session.

Input:

<agent_id>

＜start_time 〉, the scanning start time.

Output:

＜handle 〉, return to the search handle of the caller of current scanning, be used to follow the tracks of whole scanning sequence.

＜afile 〉, first accessory information that finds in the system.

MDAScanAllFindNext (): the next accessory information structure of obtaining current scanning.In a MDAScan session, be called.This API Calls can cause an InformationStore to be closed, and another Information Store is opened.

Input:

<agent_id>

Output:

＜afile 〉, the next accessory information that finds in the system.

MDACloseFindHandle (): close the current search handle---will finish current scanning.Call with a movable handle.Can be at a MDAScanAllFindFirst (), MDAScanAllFindNext () is called behind MDAScanDatabaseFindFirst () or the MDAScanDatabaseFindNext ().

Input:

<agent_id>

MDAScanDatabaseFindFirst (): the Information Store of scanning appointment also returns the tabulation that is stored in all attachment files there.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent (), but can not in officely what be called in its activity scanning sequence.

Input:

<agent_id>

＜path 〉, the pathname with the Lotus Notes database that is scanned only is used for Lotus Notes, otherwise is set to sky.

＜istoreUID 〉, with the user ID of the Information Store that is scanned---only be used for Exchange, otherwise be set to sky.

<start_time>

Output:

＜afile 〉, first annex that finds in the storage.

MDAScanDatabaseFindNext (): the next accessory information structure of obtaining current scanning.This API is called in a MDAScan session.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

Output:

＜afile 〉, the next annex that finds in the system.

MDADeleteFile (): delete the temporary file of creating for detached accessories and remove annex.If filePath is not empty, deletion is by the file of its appointment.If afile or attachInfo are not empty, enter message and therefrom delete annex.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

＜afile 〉, comprise accessory information, and the database handle of current information storage.

＜filePath 〉, the path of temporary file.

MDAExtractFile (): attachment content is extracted in the temporary file.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

<afile>

Output:

MDAAttachFile () a: file is attached on the annex of an existence.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

<afile>

MDAGetMailInfoFromAFile () a: file is attached on the annex.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

<afile>

Output:

＜mail 〉, about the information of the message that comprises annex.The buffer zone at one group of pointed real data place.

＜buffer 〉, comprise output information.

The size of above-mentioned buffer zone.

MDAGetAttFileCountFromMessage (): obtain attachment files tabulation by the particular message of message identifier appointment.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

＜messageUID 〉, the user ID of message.

Output:

Attachment files list of file names in this message.

The size of above-mentioned tabulation.

MDASendMail (): send mail to designated user.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

MessageUID

With the name of opening

The recipient of message

The sender of message

Message subject

Message body

MDAGetError (): obtain error message from the Agency.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

MDAGetMsgTime (): the Delivery time mark that obtains specify message.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

＜msgUID 〉, be used for searching this message by Exchange at mailbox.

Output:

Time mark.

MDAGetOwnerName (): the possessory name of obtaining a particular attachment file.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

<afile>

Output:

Possessory name.

MDAEstimateAttFiles (): on server, estimate to contain to be later than＜start_time〉size and the number of attachment files of time mark.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

<startt_ime>

Output:

The sum of attachment files.

The summation of all attachment files sizes.

MDASetDetachedDir (): a temp directory is set to separate catalogue.Can be called in any time between MDAConnectAgent () and the MDADisconnectAgent ().

Input:

<agent_id>

With the separation directory path that is created.

MDAFreeResource (): the resource that is released to the user ID distribution of appointment.The current Exchange that only supports.

Input:

<agent_id>

<uid>

Output:

The sign of success or system mistake.

The scans e-mail annex can take place on predetermined or real-time basis.When Scan for Viruses on predetermined basis, the time interval that the user utilizes antiviral application software 120 invisible scannings to take place, for example per 10 minutes, per hour, etc.The Email that mail server program 130 receives in a last time interval is scanned.If there is not new mail to be received, then scanning does not take place.Like this, when scanning is subjected to the control of antiviral application software 120.

Whenever an email message is received by the user, real time scan will scan this Email and no matter whether this user is connected to mail server program 130, also no matter whether the user reads or visit this email message.If there is not mail to be received, scanning does not take place.

Like this, not having the user to sign in to PC 10 or workstation 30 is necessary for the running that triggers agency 110 of the present invention.

In typical embodiments of the present invention, be used for the following realization of real time scan ability and the description of the exchange server program of Microsoft.It provides the real time scan ability for the exchange server of Microsoft.That is, in case an email message is sent to a mailbox, agency 110 is called immediately.If there is annex, the agency 110 will isolate appended file, and they are sent to antiviral application software 120 be used for scanning.If virus is detected, antiviral application software 120 can be removed virus and call agency 110 and enclose infected file again.

APIs (following description) comprises the readjustment ability in real time.Antiviral application software 120 provides the call back function to acting on behalf of 110.When agency 110 finds that some are antiviral application software 120 interested things (is the email message that contains annex at this), act on behalf of 110 and notify antiviral application software 120.In typical embodiments of the present invention, the filename that the agency isolates annex and annex is provided to antiviral application software 120 is to activate the scanning to annex.

Following false code has been described the APIs that is used for the of the present invention true-time operation relevant with the Exchange program of Microsoft:

Function

RTConnectAgent()；

RTDisconnectAgent()；

RTGetError()；

RTSetDetachedDir()；

RTSetCallbackFunction()；

RTStartupNotification()；

RTShutdownNotification()；

RTSetExcludeFileExtension()；

RTConnectAgent (): the connection that is established to the real-time messages agency.In office what is the need for wanted＜agent_id〉be called before the MDI API Calls as input parameter.

Input:

<server_name>

Windows nt server name.

<agent_name>

The name of Message Agent.

<user_id>

User's Windows NT login name.

The characteristic data file name that is used to login.

Output:

<agent_id>

The connection identifier that returns can be used to follow the tracks of current connection example by follow-up API.

RTDisconnectAgent (): be disconnected to the current connection of Message Agent.Behind each MDA conversation end, be called to discharge resource.

Input:

The connection identifier of current connection.

RTSetExcludeFileExtension (): the address that the inocuLan call back function is set.

Input:

The connection identifier of current connection.

All files | all get rid of | only with tabulation.

Escape character (ESC) string counting among the extString.

Escape character (ESC) tandem table.

RTSetCallbackFunction (): the address that the inocuLan call back function is set.

Input:

<agent?ID>

The connection identifier of current connection.

The address of call back function.RTStartupNotification (): start real-time informing.

Input:

The connection identifier of current connection.RTShutdownNotification (): close real-time informing.

Input:

The connection identifier of current connection.RTGetError (): obtain error message from the Agency.

Input:

The ConnectionID of current connection.

Wrong return code from the Agency.

Output:

<err_buff>

The buffer zone that comprises error message.

＜buff_size〉RTSetDetachedDir (): the catalogue of temp directory for separating is set.

Input:

The connection identifier of current connection.

<detached_dir>

With the separation directory path that is created.

Certainly, above-mentioned real time scan ability also can be that the mail server outside the Microsoft Exchange is realized.For example, Lotus Notes database, wherein each database is a file, whenever a new message is placed into this document, this document must be opened.Like this, utilize the routine interface (hooks) of operating system grade, agency 110 can notify antiviral application software 120 when new email message is received.

Should be appreciated that the present invention is with Windows NT WIN32 APIs, Lotus Notes APIs, first anti-virus agent based on server that Microsoft Exchange APIs and MAPI set up.Client is transparent for the existence of so antiviral entity.

And agency 110 of the present invention is general agencies, can with any antiviral server program interface.

The agency of typical embodiments of the present invention can utilize and comprise computer-readable instruction, as the logical circuit or the calculator memory (for example, the memory device of server 20) of computer program.The function of logical circuit or calculator memory as mentioned above.Computer program can be stored in hard disk, CD-ROM, or on the floppy disk.

Claims

1. for to use in the computer network that contains client-server architecture and message system, based on server, the method that is used for detecting and remove the computer virus of the annex that is positioned at email message comprises the steps:

A trace interval is provided;

On server, the search message system is to obtain the accessories list of the email message that message system receives in previous trace interval;

On server, send each annex in the accessories list to antiviral detection module and be used for scanning computer virus;

At antiviral detection module, detect and remove the computer virus in each annex in the accessories list; And

On server, each annex is attached on the email message again.

2. the method for claim 1 further comprises the step that repeats this method through each trace interval.

3. the process of claim 1 wherein that email message comprises the email message from the user on the workstation of the client-server network at message system place.

4. the method for claim 3, wherein email message comprises the email message from the external message system.

5. the process of claim 1 wherein that email message comprises the email message that receives by the Internet.

6. for to use in containing the client-server computer network of mail server, the method that is used to detect and remove the computer virus of the annex that is positioned at email message comprises following steps:

A., a trace interval is set;

B. on server, the search mail server is to obtain in previous trace interval the accessories list to the email message of mail server input;

C. on server, detect and remove the computer virus in each annex in the accessories list; And

D. on server, each annex is attached to again on the email message of mail server.

7. the method for claim 6 further comprises the step through each trace interval repeating step B. to D..

8. the method for claim 6, wherein step C. further comprises and sends each annex in the accessories list to step that antiviral detection module is used for scanning computer virus.

9. for to use in containing the client-server computer network of mail server, the method that is used to detect and remove the computer virus of the annex that is positioned at email message comprises following steps:

A. obtain trace interval;

B. search for mail server to be based upon the accessories list of the email message of importing to mail server in the previous trace interval;

C. each annex in the accessories list is sent to antiviral detection module and be used for scanning and dump virus;

D. after antiviral detection module scanning and dump virus, each annex is attached to again on the email message of mail server; And

E. pass through each trace interval repeating step B. to D..

10. in the client-server computer network that contains a plurality of workstations and a server, to use, this server comprises a message system, comprises following steps based on the method for computer virus that is used to detect and remove the annex that is positioned at email message of server:

Receive email message at message system;

When receiving email message, determine whether this email message comprises annex;

If this email message does not comprise annex, then forward next bar email message to and judge whether it contains annex;

If this email message comprises annex, annex is passed to antiviral detection module be used for scanning computer virus;

At antiviral detection module, detect and remove the computer virus in the annex; And

Each annex is attached on the email message again.

11. the method for claim 10, the method that wherein receives email message comprises the step that receives email message from external computer networks.

12. the method for claim 10, the method that wherein receives email message comprises the step that receives email message from workstation.

13. contain in the computer network of a plurality of nodes at first, this first computer network is configured to move an e-mail system and is used for sending and receiving a plurality of email messages between a plurality of node, a subclass of these a plurality of email messages contains an annex that interrelates at least, a kind of method is used for detecting and dump virus from the annex of a plurality of email messages, and this method comprises following steps:

From each message of the subclass of these a plurality of email messages, isolate this at least one annex;

The annex of at least one sends an antiviral application program to this;

According to antiviral application program, scan this at least one annex to detect at least one computer virus;

Remove this at least one computer virus the annex of at least one from this; And

The annex of at least one is attached in a plurality of email messages on corresponding one again with this.

14. according to the method for claim 13, have at least in wherein a plurality of email messages one from another computer network of first computer network communication.

15., have one at least from first computer network in wherein a plurality of email messages according to the method for claim 13.

16. according to the method for claim 13, wherein whether annex is scanned no matter be opened or browsed all by the user.

17. according to the method for claim 13, wherein annex is not scanned with not being subjected to user intervention.

18. according to the method for claim 17, have at least in wherein a plurality of email messages one from another computer network of first computer network communication.

19. contain in the computer network of a plurality of nodes at first, this first computer network is configured to move an e-mail system and is used for sending and receiving a plurality of email messages between a plurality of node, a subclass of these a plurality of email messages contains an annex that interrelates at least, a kind of method is used for from least one annex detection and removes at least one computer virus, and this method comprises following steps:

From each of this a plurality of email messages, isolate this at least one annex;

Determine that whether this at least one annex is by at least one computer virus infection;

20. be used for detecting and remove the system of the computer virus of the annex that is positioned at email message, this system is in individual client-server computer network, this network contains a server computer, a plurality of client computers, and the message system of distribution that is used to control email message that is positioned at server computer, comprising:

Be positioned at the antiviral module that scanning document detects virus that is used for of server computer; And,

Be positioned at the agency of server computer, this agency provides the interface between antiviral module and the message system, and comprises

Receive the device of trace interval;

The search message system is to obtain the device of the accessories list of the email message of message system reception in previous trace interval;

Send each annex in the accessories list to device that antiviral module is used for scanning computer virus; And

Each annex is attached to device on the email message again.

21. the system of claim 20, wherein email message comprises the email message from client computer on the computer network.

22. the system of claim 20, wherein message system comprises an exterior gateway, and email message comprises the email message from the external message system.

23. the system of claim 20, wherein email message comprises the email message that connects reception by the Internet.

24. the anti-virus agent that in the client-server computer network that contains a server computer and a plurality of client computers, uses, this server computer comprises the mail server that contains email message, this anti-virus agent auxiliary detection is arranged in the computer virus of the annex of email message, comprising:

The device of trace interval is set;

Be positioned on the server computer, be used to search for mail server to obtain in previous trace interval device to the accessories list of the email message of mail server input;

Each annex in the accessories list is passed to antiviral detection module to detect the also device of dump virus; And

Be positioned on the server computer, be used for each annex is attached to device on the email message of mail server again.

25. the system of claim 24 further comprises the device of the computer virus of each annex that is used for detecting and remove accessories list.

26. contain a plurality of nodes at first, and be configured to move an e-mail system is used for sending and receiving a plurality of email messages between a plurality of nodes computer network, a subclass of these a plurality of email messages contains an annex that interrelates at least, a system is used for detecting and dump virus from the annex of a plurality of email messages, and this system comprises:

From each message of the subclass of these a plurality of email messages, isolate the device of this at least one annex;

The annex of at least one sends the device of an antiviral application program to this;

According to antiviral application program, scan this at least one annex to detect the device of at least one computer virus;

Remove the device of this at least one computer virus the annex of at least one from this; And

The annex of at least one is attached to the device on corresponding in a plurality of email messages again with this.

27. the system of claim 26, in wherein a plurality of email messages at least one message from another computer network of first computer network communication.

28. the system of claim 26, at least one message is from first computer network inside in wherein a plurality of email messages.

29. contain a plurality of nodes at first, and be configured to move an e-mail system is used for sending and receiving a plurality of email messages between a plurality of nodes computer network, a subclass of these a plurality of email messages contains an annex that interrelates at least, system is used for detecting and removing at least one computer virus from least one annex, and this system comprises:

From each of this a plurality of email messages, isolate the device of this at least one annex;

Determine that whether this at least one annex is by the device of at least one computer virus infection;

30. real-time system that is used for detecting the computer virus of the annex that is positioned at email message, this system is in a client-server computer network, this network comprises a server computer, a plurality of client computers, with be positioned at the distribution that server computer is used to control email message, and comprise the message system of a plurality of mailbox, this real-time system comprises:

Be positioned at the antiviral module of server computer, be used for scanning document to detect virus; And

Be positioned at the agency of server computer, this agency provides the interface between antiviral module and the message system, is activated when an email message is delivered to a mailbox, and comprises:

Determine whether an email message comprises the device of annex;

From email message, isolate the device of annex;

Activate antiviral module and come the device of sweep attachment with detection computations machine virus; And

Each annex is attached to device on the email message again.

31. the real-time system of claim 30, wherein the device of Jian Ceing further comprises the device that annex is saved in a file.

32. the real-time system of claim 30, wherein the device of Ji Huoing further comprises the device to the file address that antiviral module circular saves attachment.

33. the real-time system of claim 30, wherein email message comprises the email message that the client computer from the computer network receives.

34. the real-time system of claim 30, wherein agency's interface between system and a plurality of different antiviral modules that gives information.

35. the real-time system of claim 30, wherein the agency provides the interface between antiviral module and a plurality of different message systems.